[Bro] multiple workers per cluster node

Dop dopheide at ncsa.illinois.edu
Fri Mar 4 20:50:50 PST 2011

Thanks everyone for the replies and suggestions.  Apparently I just forgot
to run 'install' after changing the node config which is embarrassing, but
I still find it interesting that they all reacted differently.

For future reference, all of the instances that fail show:

/usr/local/bro/share/bro/broctl/cluster-worker.remote.bro, line 14
(BroCtl::workers[WORKER]): run-time error, no such index
/usr/local/bro/share/bro/broctl/cluster-worker.remote.bro, line 13
($host=BroCtl::manager$ip, $p=BroCtl::manager$p,
$events=Remote::manager_events, $connect=T, $sync=F, $retry=1.0 min,
$class=BroCtl::workers[WORKER]$tag): run-time error, uninitialized list
/usr/local/bro/share/broctl/scripts/run-bro: line 73: 27140 Segmentation
fault      (core dumped) nohup $tmpbro $@


-----Original Message-----
From: Justin Azoff <JAzoff at uamail.albany.edu>
Date: Fri, 4 Mar 2011 19:50:23 -0500
To: Dop <dopheide at ncsa.illinois.edu>
Cc: "bro at bro-ids.org" <Bro at bro-ids.org>
Subject: Re: [Bro] multiple workers per cluster node

>On Fri, Mar 04, 2011 at 05:29:40PM -0500, Dop wrote:
>> Hopefully quick question.  How would you go about configuring Bro
>> nodes to each run dual clients (one per input interface)?
>> ...
>> What's strange is that it seems to fail unevenly.  Fails totally on 21,
>> partially on 22 and 23, but works on 24.  It's always the same nodes
>> failing.
>This should work fine,  I run 4 workers on one machine without any
>It sounds like maybe you have some filesystem issues preventing bro from
>What do you have in /usr/local/bro/spool/ for each of the failing nodes?
>Is there anything in the stdout or stderr logs?
>/usr/local/bro/spool/debug.log may also have useful info
>I would focus on the machine that it starts partially on.
>-- Justin Azoff
>-- Network Security & Performance Analyst

More information about the Bro mailing list